diff --git a/charts/retool/Chart.yaml b/charts/retool/Chart.yaml
index b242b30..6fbac83 100644
--- a/charts/retool/Chart.yaml
+++ b/charts/retool/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: retool
 description: A Helm chart for Kubernetes
 type: application
-version: 6.2.10
+version: 6.2.11
 maintainers:
   - name: Retool Engineering
     email: engineering+helm@retool.com
diff --git a/charts/retool/templates/externalsecret.yaml b/charts/retool/templates/externalsecret.yaml
index d481096..6c396ae 100644
--- a/charts/retool/templates/externalsecret.yaml
+++ b/charts/retool/templates/externalsecret.yaml
@@ -1,5 +1,6 @@
 {{- if .Values.externalSecrets.externalSecretsOperator.enabled }}
 {{- range .Values.externalSecrets.externalSecretsOperator.secretRef }}
+{{- if .Values.externalSecrets.externalSecretsOperator.useLegacyCR }}
 apiVersion: kubernetes-client.io/v1
 kind: ExternalSecret
 metadata:
@@ -13,5 +14,27 @@ spec:
   dataFrom:
     - {{ .path }}
 ---
+{{- else }}
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  annotations:
+    "helm.sh/hook-weight": "1"
+    "helm.sh/hook": pre-install,pre-upgrade
+  name: {{ .name }}
+  namespace: {{ $.Release.Namespace }}
+spec:
+  refreshInterval: 1m
+  secretStoreRef:
+    name: aws-secretsmanager
+    kind: SecretStore
+  target:
+    name: {{ .name }}
+    creationPolicy: Owner
+  dataFrom:
+    - extract:
+        key: {{ .path }}
+---
+{{- end }}
 {{- end }}
 {{- end }}
diff --git a/charts/retool/values.yaml b/charts/retool/values.yaml
index fb3110d..984baf6 100644
--- a/charts/retool/values.yaml
+++ b/charts/retool/values.yaml
@@ -114,6 +114,9 @@ externalSecrets:
       #   path: global-retool-config
       # - name: retool-db
       #   path: global-retool-db-config
+    # When true, uses kubernetes-client CRDs and not external-secrets CRDs
+    # Defaults to true
+    useLegacyCR: true
 
 files: {}
 
diff --git a/values.yaml b/values.yaml
index fb3110d..984baf6 100644
--- a/values.yaml
+++ b/values.yaml
@@ -114,6 +114,9 @@ externalSecrets:
       #   path: global-retool-config
       # - name: retool-db
       #   path: global-retool-db-config
+    # When true, uses kubernetes-client CRDs and not external-secrets CRDs
+    # Defaults to true
+    useLegacyCR: true
 
 files: {}